CVSS: 6.4EPSS: 0%CPEs: 4EXPL: 1CVE-2022-43561 – Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk Enterprise
https://notcve.org/view.php?id=CVE-2022-43561
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store arbitrary scripts that can lead to persistent cross-site scripting (XSS). The vulnerability affects instances with Splunk Web enabled. En las versiones de Splunk Enterprise inferiores a 8.1.12, 8.2.9 y 9.0.2, un usuario remoto que posee el poder del rol Splunk puede almacenar scripts arbitrarios que pueden generar Cross-Site Scripting (XSS) persistentes. La vulnerabilidad afecta a instancias con Splunk Web habilitado. • https://research.splunk.com/application/a974d1ee-ddca-4837-b6ad-d55a8a239c20 https://www.splunk.com/en_us/product-security/announcements/svd-2022-1101.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-37437 – Ingest Actions UI in Splunk Enterprise 9.0.0 disabled TLS certificate validation
https://notcve.org/view.php?id=CVE-2022-37437
When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service (S3) in Splunk Web, TLS certificate validation is not correctly performed and tested for the destination. The vulnerability only affects connections between Splunk Enterprise and an Ingest Actions Destination through Splunk Web and only applies to environments that have configured TLS certificate validation. It does not apply to Destinations configured directly in the outputs.conf configuration file. The vulnerability affects Splunk Enterprise version 9.0.0 and does not affect versions below 9.0.0, including the 8.1.x and 8.2.x versions. Cuando son usadas Acciones de Ingesta para configurar un destino que reside en Amazon Simple Storage Service (S3) en Splunk Web, la comprobación del certificado TLS no es lleva a cabo correctamente ni es comprobada para el destino. • https://www.splunk.com/en_us/product-security/announcements/svd-2022-0801.html • CWE-295: Improper Certificate Validation •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-37439 – Malformed ZIP file crashes Universal Forwarders and Splunk Enterprise through file monitoring input
https://notcve.org/view.php?id=CVE-2022-37439
In Splunk Enterprise and Universal Forwarder versions in the following table, indexing a specially crafted ZIP file using the file monitoring input can result in a crash of the application. Attempts to restart the application would result in a crash and would require manually removing the malformed file. En las versiones de Splunk Enterprise y Universal Forwarder de la siguiente tabla, la indexación de un archivo ZIP especialmente diseñado mediante la entrada de monitorización de archivos puede resultar en un bloqueo de la aplicación. Los intentos de reiniciar la aplicación resultarían en un bloqueo y requerirían la eliminación manual del archivo malformado. • https://research.splunk.com/application/b237d393-2f57-4531-aad7-ad3c17c8b041 https://www.splunk.com/en_us/product-security/announcements/svd-2022-0803.html • CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) •
CVSS: 3.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-37438 – Information disclosure via the dashboard drilldown in Splunk Enterprise
https://notcve.org/view.php?id=CVE-2022-37438
In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information (for example, username, email, and real name) about Splunk users, when visited by another user through the drilldown component. The vulnerability requires user access to create and share dashboards using Splunk Web. En las versiones de Splunk Enterprise de la siguiente tabla, un usuario autenticado puede diseñar un panel de control que podría filtrar información (por ejemplo, nombre de usuario, correo electrónico y nombre real) sobre los usuarios de Splunk, cuando es visitado por otro usuario por medio del componente drilldown. La vulnerabilidad requiere el acceso del usuario para crear y compartir cuadros de mando usando Splunk Web. • https://research.splunk.com/application/f844c3f6-fd99-43a2-ba24-93e35fe84be6 https://www.splunk.com/en_us/product-security/announcements/svd-2022-0802.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-32158 – Splunk Enterprise deployment servers allow client publishing of forwarder bundles
https://notcve.org/view.php?id=CVE-2022-32158
Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulnerability to execute arbitrary code on all other Universal Forwarder endpoints subscribed to the deployment server. Los servidores de despliegue de Splunk Enterprise en versiones anteriores a la 8.1.10.1, 8.2.6.1 y 9.0 permiten a los clientes desplegar paquetes de reenvío a otros clientes de despliegue a través del servidor de despliegue. Un atacante que comprometiera un punto final de Universal Forwarder podría utilizar la vulnerabilidad para ejecutar código arbitrario en todos los demás puntos finales de Universal Forwarder suscritos al servidor de despliegue • https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates https://www.splunk.com/en_us/product-security/announcements/svd-2022-0608.html • CWE-284: Improper Access Control •